Like many visitors to the Microsoft newsgroups (at msnews.microsoft.com) you're probably wondering: "Didn't Microsoft test this?" Well, yes, but...Service Packs usually have a limited number of outside beta testers and the beta notes did not mention security changes. Apparently few, if any, beta testers used programs that triggered the warnings in Outlook, so no one knew about the security changes prior to the official release, or which add-ins would trigger the security warnings. Additionally, in a move that is inexcusable, release notes did not mention the security changes and the KB articles covering the changes were not available at the time of SP3's release.

Administrators should not apply this Service Pack on production systems until thoroughly testing it with their custom applications and forms first. My personal recommendation is to wait at least two weeks to see what develops. While I don't believe Microsoft will re-release the patch with these new security features removed, waiting will give vendors time to update their software, resulting in less inconvenience to users. Note that while Outlook is getting all the attention, there are some minor issues with Excel and Word as well.

Product availability and resources For more information on disabling the Outlook Today exploit, visit http://www.microsoft.com/technet/security/Bulletin/MS04-009.mspx. You can test Outlook by visiting http://www.nettwerked.co.uk/code/outlooksploit.html or learn more about the test at http://www.securityfocus.com/archive/1/357055/2004-03-10/2004-03-16/0. For the latest information on Outlook 2002 SP3, including a list of applications and add-ins known to be affected, see http://www.slipstick.com/outlook/ol2002sp3.htm. Developers can learn more about changes brought about in SP3 by visiting http://www.outlookcode.com/d/sec.htm. Information concerning changes that affect custom forms is at http://www.outlookcode.com/d/secforms.htm. For a list of all issues that are fixed for Microsoft Outlook 2002 in Service Pack 3, see Description of Microsoft Office XP Service Pack 3, visit http://support.microsoft.com/default.aspx?kbid=836033. Custom solutions and add-ins that integrate with Outlook 2002 are affected after you apply Office XP Service Pack 3 (SP3) can be found at http://support.microsoft.com/default.aspx?kbid=838871. To download Office SP3, visit http://www.microsoft.com/downloads/details.aspx?familyid=85af7bfd-6f69-4289-8bd1-eb966bcdfb5e. Note that SP3 contains all updates included in Office XP Service Pack 1 (SP1) and Office XP Service Pack 2 (SP2), and updates released after SP2.

Francine Otterson is the President of the San Diego Outlook User Group and a Microsoft Outlook MVP. She has been in the IT industry for over 10 years, providing technical support, software customization solutions and training in corporate settings, and as a consultant. She balances her work around her daughter and husband in sunny San Diego, California.